Why does this connector look different from most others?Unlike most of the software ConductorOne integrates with, 1Password doesn’t expose APIs that can be used to connect the two systems. Additionally, 1Password data can only be gathered from unlocked vaults, which means that a user must unlock the vault and manually kick off the data collection process; a periodic automated data pull won’t work.To work around these issues, ConductorOne’s 1Password Baton connector uses the 1Password CLI to interact with your vaults. Once the CLI is set up,
baton-1password uses it to interact with your 1Password vaults. The connector will capture user and entitlement data in a file that you upload to ConductorOne.Capabilities
| Resource | Sync | Provision |
|---|---|---|
| Accounts | ||
| Groups | ||
| Vaults | ||
| Projects |
Configure the 1Password connector
To complete this task, you’ll need:
- The Connector Administrator or Super Administrator role in ConductorOne
- 1Password 8 on a Families, Teams, Business, or Enterprise plan
- A 1Password vault
- Cloud-hosted
- Self-hosted
Follow these instructions to use a built-in, no-code connector hosted by ConductorOne.Cloud-hosted connector not currently available.
Follow these instructions to use the 1Password connector, hosted and run in your own environment.Step 2: Install and run
That’s it! Your 1Password connector is now pulling access data into ConductorOne
Step 1: Set up the 1Password CLI and locate your sign-in address
1
Install the 1Password CLI and make sure it is upgraded to the current version.
2
Locate your 1Password sign-in address by following the instructions in the 1Password docs. We’ll use this address in Step 2.
Step 2: Install and run baton-1password
1
Run the relevant source commands shown below to install If using a service account:If you’re using a service account, its token must be stored in a local environment variable in order for the 1Password CLI to authenticate properly.
baton-1password, substituting the sign-in address you looked up in Step 1 for myaddress.1password.com.
If using a user account:Report incorrect code
Copy
Ask AI
go install github.com/conductorone/baton/cmd/baton@main
go install github.com/conductorone/baton-1password/cmd/baton-1password@main
BATON_ADDRESS=myaddress.1password.com baton-1password
BATON_AUTH_TYPE=service
OP_SERVICE_ACCOUNT_TOKEN=your service account token
baton resources
Report incorrect code
Copy
Ask AI
go install github.com/conductorone/baton/cmd/baton@main
go install github.com/conductorone/baton-1password/cmd/baton-1password@main
BATON_ADDRESS=myaddress.1password.com baton-1password
BATON_AUTH_TYPE=service
OP_SERVICE_ACCOUNT_TOKEN=your service account token
baton resources
Step 3: Configure the 1Password connector in ConductorOne
1
In ConductorOne, navigate to Connectors > Add connector.
2
Search for Baton and click Add.
3
Choose how to set up the new 1Password connector:
- Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)
- Add the connector to a managed app (select from the list of existing managed apps)
- Create a new managed app
4
Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.If you choose someone else, ConductorOne will notify the new connector owner by email that their help is needed to complete the setup process.
5
Click Next.
6
In the Settings area of the page, click Edit.
7
Click Rotate to generate a new Client ID and Secret.Carefully copy and save these credentials. We’ll use them in Step 2.
Step 4: Add credentials to your self-hosted connector
1
On the server or VM where your self-hosted connector is running, pass in the Client ID and Secret generated in Step 3 by running
--client-id <CLIENT ID> --client-secret <SECRET>.Run baton-1password --help to see the list of flags to be used when passing your credentials to the connector.2
The connector syncs current data, uploads it to ConductorOne, and prints a
Task complete! message when finished.3
Check that the connector data uploaded correctly. In ConductorOne, click Applications. On the Managed apps tab, locate and click the name of the application you added the Baton connector to. The data should be found on the Resources and Accounts tabs, as appropriate.